{"id":155278,"date":"2026-01-26T11:12:14","date_gmt":"2026-01-26T09:12:14","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/login-probel-defis-root-bag-v-telnet-pozvolyaet-zahvatit-kompyuter-bez-parolya"},"modified":"2026-01-26T11:12:14","modified_gmt":"2026-01-26T09:12:14","slug":"login-probel-defis-root-bag-v-telnet-pozvolyaet-zahvatit-kompyuter-bez-parolya","status":"publish","type":"post","link":"https:\/\/prohoster.info\/et\/blog\/novosti-interneta\/login-probel-defis-root-bag-v-telnet-pozvolyaet-zahvatit-kompyuter-bez-parolya","title":{"rendered":"Kasutajanimi, t\u00fchik, kiri, root. Telneti viga v\u00f5imaldab arvutit paroolita haarata","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

GNU InetUtils'i paketis avastati haavatavus, mis m\u00f5jutab k\u00f5iki versioone alates 1.9.3 kuni 2.7, sealhulgas.<\/p>\n

Tundub, et telnet on ammu minevikku j\u00e4\u00e4nud koos modemite ja dial-up'iga, kuid just see on ootamatult muutunud t\u00f5siseks haavatavuse allikaks. GNU InetUtils'is leiti viga, mis v\u00f5imaldab root-kasutajana s\u00fcsteemi sisselogimist ilma paroolita, saates lihtsalt spetsiaalselt vormindatud keskkonnamuutuja v\u00e4\u00e4rtuse.<\/p>\n

Probleem puudutab telnetd serverit, mis kuulub GNU InetUtils'i. See edastab login programmile kliendilt saadud USER muutuja v\u00e4\u00e4rtuse ilma igasuguse kontrollita. Seda saab \u00e4ra kasutada, kui klient saadab stringi \"-f root\" USER'ina ja \u00fchendub parameetriga telnet -a v\u00f5i \u2013login. Tulemuseks peab login seda teenuse lipuna, m\u00f6\u00f6da minnes tavaline autentimisprotseduur ja autoriseerib kasutaja automaatselt kui root.<\/p>\n

Haavatavus sai tuvastatud CVE-2026-24061 identifikaatori ja CVSSi skooriks 9.8. Ohus on k\u00f5ik GNU InetUtils'i versioonid alates 1.9.3 kuni 2.7, sealhulgas. Vigad on olnud projektis peaaegu 11 aastat, alates maist 2015, kuid avastati alles n\u00fc\u00fcd. Tegelikult on see klassikaline n\u00e4ide vanakooli haavatavusest, kus filtreerimata ohtlik string edastatakse root-privileegidega s\u00fcsteemiteenusele.<\/p>\n

Advisory autorid soovitavad tungivalt mitte kasutada telnetd-d, piirata telnet-porti ligip\u00e4\u00e4su ainult usaldusv\u00e4\u00e4rsete klientidega ja paigaldada patch v\u00f5imalikult kiiresti v\u00f5i uuenduda versioonile, kus probleem on lahendatud. Ajutiseks lahenduseks v\u00f5ib olla telnetd t\u00e4ielik v\u00e4ljal\u00fclitamine v\u00f5i kohandatud login versiooni kasutamine, mis ei toeta \"-f\" parameetrit.<\/p>\n

Haavatavuse avastas uurija Carlos Cortes Alvarez, patch valmis ja t\u00f6\u00f6tati v\u00e4lja GNU InetUtils arendajate poolt jaanuaris 2026. Parandused sisaldavad sanitiseerimist k\u00f5igist muutujatest, mida kasutatakse login'i k\u00e4su moodustamisel, et sarnased r\u00fcnnakud oleksid p\u00f5him\u00f5tteliselt v\u00f5imatud.<\/p>\n

Ajalugu n\u00e4ib peaaegu s\u00fcmboolne: aegunud protokoll, unustatud teenus ja klassikaline loogikaviga viisid s\u00fcsteemi t\u00e4ieliku kompromiteerimiseni. Veel \u00fcks meeldetuletus, et isegi \"vana\" tehnoloogia v\u00f5ib endiselt kujutada t\u00f5elist ohtu, kui see t\u00f6\u00f6tab endiselt tootmises.<\/p>\n

Vahetult p\u00e4rast teabe avalikustamist haavatavuse kohta k\u00e4ivitas teadlaste meeskond honeypot-andurid, et j\u00e4lgida reaalseid kasutuskatsed. R\u00fcndajad ei lasknud end kaua oodata. 18 tunni jooksul toimunud vaatluste jooksul registreeriti 60 h\u00e4kkimis\u00fcritust 18 ainulaadselt IP-aadresse<\/a>. Censys platvormi andmetel oli potentsiaalselt haavatavaid s\u00fcsteeme maailmas umbes kolm tuhat, kuigi suur osa neist on t\u00f5en\u00e4oliselt samuti honeypot-l\u00f5ksud.<\/p>\n

P\u00fc\u00fcdkuutetud liiklusanal\u00fc\u00fcs n\u00e4itas \u00fcsna kirju pilti. K\u00f5ige aktiivsem oli r\u00fcndaja aadressilt 178.16.53.82, kes viis l\u00e4bi 12 sessiooni 10 erineva sihtm\u00e4rgi vastu. Tema tegevus oli t\u00e4ielikult automatiseeritud: p\u00e4rast sissep\u00e4\u00e4su saamist k\u00e4ivitati standardne luure Command'ide komplekt nagu uname -a, id, lugedes \/proc\/cpuinfo ja \/etc\/passwd. Iseloomulikuks omaduseks oli k\u00e4skude v\u00e4ljundi m\u00fctsimine spetsiaalsete m\u00e4rgistega edasise t\u00f6\u00f6tluse jaoks, mis n\u00e4itab selgelt botnet\u2019i v\u00f5i automatiseeritud andmete kogumiss\u00fcsteemi.<\/p>\n

T\u00f5husam oli kurjategija aadressilt 216.106.186.24. Ta keskendus konkreetsesse alamv\u00f5rku ja \u00fcritas seadistada SSH-v\u00f5tme p\u00fcsivaks juurdep\u00e4\u00e4suks, samuti laadida alla ja k\u00e4ivitada Python-skeemi v\u00e4liselt serverilt \u2014 eeldatavasti, pahavara kr\u00fcptomineerimiseks v\u00f5i botnet'i jaoks. T\u00f5si, m\u00f5lemad katsed eba\u00f5nnestusid: sihts\u00fcsteemis puudus kataloog .ssh ning samuti olid puudu curl ja python.<\/p>\n

Eriti t\u00e4helepanuv\u00e4\u00e4rsed on kaks r\u00fcndajat IP-aadressidega 167.172.111.135 ja 165.22.30.48. Erinevalt teistest ei p\u00fc\u00fcdnud nad kohe root-juurdep\u00e4\u00e4su saada, vaid eksperimentaalne t\u00f6\u00f6 viidatud kontode, nagu nobody, daemon ja isegi mittetekkiva konto nonexistent123, kaudu. Ajavahed sessioonide vahel ja nende tegevuse loogika viitavad sellele, et klaviatuuril on tegelik inimene. T\u00f5en\u00e4oliselt on need kogenumad h\u00e4kkerid, kes on teadlikud sissetungi avastamise s\u00fcsteemidest ja tunnevad k\u00f5rgendamisv\u00f5tteid h\u00e4sti.<\/p>\n

M\u00f5ned r\u00fcndajad n\u00e4itasid operatiivsete kaitsemehhanismide osas h\u00e4mmastavat hooletust. N\u00e4iteks r\u00fcndaja IP-aadressiga 67.220.95.16 kasutas sama IP-aadressi nii ekspluateerimiseks kui ka pahavara teenusehostimiseks. Teised paljastasid juhuslikult oma hostinimesid muutuja DISPLAY kaudu: \u00fcks t\u00f6\u00f6tas s\u00fcsteemis nimega MiniBear, teine varieeruva masinana shared-vm2.localdomain ja kolmas \u00fchendas end otse Kali Linuxi graafilisest keskkonnast.<\/p>\n

Kokkuv\u00f5ttes oli r\u00fcnnakute tase \u00fcsna madal. 18 r\u00fcnnakute allikast n\u00e4itas vaid m\u00f5ned m\u00e4rgid professionaalsusest. Enamik kasutas lihtsamaid automatiseeritud t\u00f6\u00f6riistu v\u00f5i kirjutas lihtsalt klaviatuuril, j\u00e4rgides internetist leitud juhiseid. Suurenenud Suricata sissetungi tuvastamise s\u00fcsteem tuvastas hetkeline root-juurdep\u00e4\u00e4su saamine \u00fche r\u00fcndaja poolt, kinnitades veelkord keerukate kaitsemeetmete ja v\u00f5rgu liikluse j\u00e4lgimise olulisust.<\/p>\n

Uurijad m\u00e4rgivad, et see haavatavus, \u00fchelt poolt, v\u00f5imaldas algajatel h\u00e4kkeritel praktiseerida, kuid teiselt poolt andis see julgeoleku spetsialistidele v\u00e4\u00e4rtuslikke andmeid r\u00fcndajate praeguste taktikate ja t\u00f6\u00f6riistade kohta.<\/p>\n

<\/p>\n

Loe rohkem: https:\/\/www.securitylab.ru\/news\/568478.php<\/a><\/p>\n

<\/noindex><\/noindex><\/p>\n

Allikas: linux.org.ru<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 \u043f\u0430\u043a\u0435\u0442\u0435 GNU InetUtils \u0437\u0430\u0442\u0440\u043e\u043d\u0443\u043b\u0430 \u0432\u0441\u0435 \u0432\u0435\u0440\u0441\u0438\u0438 \u0441 1.9.3 \u043f\u043e 2.7 \u0432\u043a\u043b\u044e\u0447\u0438\u0442\u0435\u043b\u044c\u043d\u043e. \u041a\u0430\u0437\u0430\u043b\u043e\u0441\u044c \u0431\u044b, telnet \u0434\u0430\u0432\u043d\u043e \u0443\u0448\u0435\u043b \u0432 \u043f\u0440\u043e\u0448\u043b\u043e\u0435 \u0432\u043c\u0435\u0441\u0442\u0435 \u0441 \u043c\u043e\u0434\u0435\u043c\u0430\u043c\u0438 \u0438 dial-up, \u043d\u043e \u0438\u043c\u0435\u043d\u043d\u043e \u043e\u043d \u0432\u043d\u0435\u0437\u0430\u043f\u043d\u043e \u0441\u0442\u0430\u043b \u0438\u0441\u0442\u043e\u0447\u043d\u0438\u043a\u043e\u043c \u0441\u0435\u0440\u044c\u0435\u0437\u043d\u043e\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438. \u0412 GNU InetUtils \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d \u0431\u0430\u0433, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u043e \u0432\u043e\u0439\u0442\u0438 \u0432 \u0441\u0438\u0441\u0442\u0435\u043c\u0443 \u043f\u043e\u0434 root \u0431\u0435\u0437 \u043f\u0430\u0440\u043e\u043b\u044f, \u043f\u0440\u043e\u0441\u0442\u043e \u043e\u0442\u043f\u0440\u0430\u0432\u0438\u0432 \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u0441\u0444\u043e\u0440\u043c\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u0435 \u0437\u043d\u0430\u0447\u0435\u043d\u0438\u0435 \u043f\u0435\u0440\u0435\u043c\u0435\u043d\u043d\u043e\u0439 \u043e\u043a\u0440\u0443\u0436\u0435\u043d\u0438\u044f. […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":8,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-155278","post","type-post","status-publish","format-standard","hentry","category-novosti-interneta"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Sisselogimine, t\u00fchi ruum, sidekriips, root. Telnet'i puudus v\u00f5imaldab arvutit paroolita haarata | ProHoster","description":"GNU InetUtils'i paketi haavatavus m\u00f5jutas k\u00f5iki versioone vahemikus 1.9.3 kuni 2.7. Kuigi telnet n\u00e4ib olevat ammu kadunud koos modemite ja dial-upiga, on see \u00fcht\u00e4kki saanud t\u00f5siseks haavatavuseks. GNU InetUtils'is avastati viga, mis v\u00f5imaldab l\u00f5ppkasutajal s\u00fcsteemi siseneda root-juurdep\u00e4\u00e4suga ilma paroolita, lihtsalt saates spetsiaalselt vormindatud keskkonnamuutuja v\u00e4\u00e4rtuse.","canonical_url":"https:\/\/prohoster.info\/et\/blog\/novosti-interneta\/login-probel-defis-root-bag-v-telnet-pozvolyaet-zahvatit-kompyuter-bez-parolya","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"et_EE","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u041b\u043e\u0433\u0438\u043d, \u043f\u0440\u043e\u0431\u0435\u043b, \u0434\u0435\u0444\u0438\u0441, root. \u0411\u0430\u0433 \u0432 telnet \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u0437\u0430\u0445\u0432\u0430\u0442\u0438\u0442\u044c \u043a\u043e\u043c\u043f\u044c\u044e\u0442\u0435\u0440 \u0431\u0435\u0437 \u043f\u0430\u0440\u043e\u043b\u044f | ProHoster","og:description":"\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 \u043f\u0430\u043a\u0435\u0442\u0435 GNU InetUtils \u0437\u0430\u0442\u0440\u043e\u043d\u0443\u043b\u0430 \u0432\u0441\u0435 \u0432\u0435\u0440\u0441\u0438\u0438 \u0441 1.9.3 \u043f\u043e 2.7 \u0432\u043a\u043b\u044e\u0447\u0438\u0442\u0435\u043b\u044c\u043d\u043e. \u041a\u0430\u0437\u0430\u043b\u043e\u0441\u044c \u0431\u044b, telnet \u0434\u0430\u0432\u043d\u043e \u0443\u0448\u0435\u043b \u0432 \u043f\u0440\u043e\u0448\u043b\u043e\u0435 \u0432\u043c\u0435\u0441\u0442\u0435 \u0441 \u043c\u043e\u0434\u0435\u043c\u0430\u043c\u0438 \u0438 dial-up, \u043d\u043e \u0438\u043c\u0435\u043d\u043d\u043e \u043e\u043d \u0432\u043d\u0435\u0437\u0430\u043f\u043d\u043e \u0441\u0442\u0430\u043b \u0438\u0441\u0442\u043e\u0447\u043d\u0438\u043a\u043e\u043c \u0441\u0435\u0440\u044c\u0435\u0437\u043d\u043e\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438. \u0412 GNU InetUtils \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d \u0431\u0430\u0433, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u043e \u0432\u043e\u0439\u0442\u0438 \u0432 \u0441\u0438\u0441\u0442\u0435\u043c\u0443 \u043f\u043e\u0434 root \u0431\u0435\u0437 \u043f\u0430\u0440\u043e\u043b\u044f, \u043f\u0440\u043e\u0441\u0442\u043e \u043e\u0442\u043f\u0440\u0430\u0432\u0438\u0432 \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u0441\u0444\u043e\u0440\u043c\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u0435 \u0437\u043d\u0430\u0447\u0435\u043d\u0438\u0435 \u043f\u0435\u0440\u0435\u043c\u0435\u043d\u043d\u043e\u0439 \u043e\u043a\u0440\u0443\u0436\u0435\u043d\u0438\u044f.","og:url":"https:\/\/prohoster.info\/et\/blog\/novosti-interneta\/login-probel-defis-root-bag-v-telnet-pozvolyaet-zahvatit-kompyuter-bez-parolya","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2026-01-26T09:12:14+00:00","article:modified_time":"2026-01-26T09:12:14+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"155278","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-02-08 20:42:45","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2026-01-26 09:12:14","updated":"2026-02-08 20:42:45"},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/155278","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/users\/8"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/comments?post=155278"}],"version-history":[{"count":1,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/155278\/revisions"}],"predecessor-version":[{"id":158081,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/155278\/revisions\/158081"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/media?parent=155278"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/categories?post=155278"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/tags?post=155278"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}